mysql_real_escape_string not working

Question

My mysql_real_escape_string is being ignored. It's killing me, because I feel like it's something tiny that I'm missing.

The $htmlText variable comes from a TinyMCE editor where the text is rendered as HTML i.e. with tags etc.

<?php 
    /*--------GLOBAL PROCEDURES--------*/
    session_start();
    require "../scr/config-data.php.inc";
    mysql_connect($host,$username,$password) or die 
    ("Could Not Connect".mysql_error());
    mysql_select_db($db) or die ("Could Not Connect".mysql_error());

    /*-----SEVERAL SELECT/INSERT QUERIES, ALL WORKING FINE-----*/

    /*--------SPECIFIC PROCEDURES-------*/      
    if($_POST['submit']){
        //Check that POS has been chosen
        $htmlText = mysql_real_escape_string($_POST['cust']);
        if($htmlText != ""){
            mysql_query("INSERT INTO table VALUES(NULL, '$htmlText' )") or die(mysql_error());
        }else{
            $feedback = "Please Enter some text into the editor";
        }
    }

    /*--------CLOSING PROCEDURES-------*/
    mysql_close();

?>

The strange thing is, it's been adapted from a script that works, only changing the variable names. I'm getting an Error in MySQL syntax. It's also not escaping the HTML in the text so I'm getting this error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order VALUES(NULL, '

sfgafgafs

')' at line 1

the above error message is given, but the particular field should be <p>sfgafgafs</p> when escaped, but it's rendering it as HTML — Dan Hanly
– Dan Hanly, Commented Jan 21, 2011 at 14:27
Is your table named "order" ? Try changing that to order (backticks) — labue
– labue, Commented Jan 21, 2011 at 14:29

codaddict · Accepted Answer · 2011-01-21 14:28:24Z

6

From the error message given by you it looks like you are using order as the table name which happens to be a MySQL reserved word.

Try enclosing it in back ticks.

answered Jan 21, 2011 at 14:28

codaddict

457k83 gold badges502 silver badges537 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Dan Hanly Over a year ago

Thanks! I did this about a week ago with the word add... Didn't learn from my own mistakes by the looks of things, cheers!

Bastian · Accepted Answer · 2011-01-21 14:28:30Z

2

mysql_real_escape_string will not escape any html. It only escapes \x00, \n, \r, \, ', " and \x1a.

Your table's name should not be "order", because it is an SQL special word. You should rename it or make sure that you put it in backticks.

answered Jan 21, 2011 at 14:28

Bastian

10.4k1 gold badge34 silver badges40 bronze badges

2 Comments

Dan Hanly Over a year ago

no, it's order but I changed it to table just for the example, to take it out of the context. But luckily, when I pasted my error message I'd left the word Order in, it's a reserved word :( thanks anyway!

Mchl Over a year ago

table is also a reserved word BTW

Santhosh Thomas Alexander · Accepted Answer · 2011-03-24 19:12:04Z

2

I too believe the reason is due to the table name being 'order', as mysql takes it like you are trying to use the order clause in an insert query, change the table name to something else..

answered Mar 24, 2011 at 19:12

Santhosh Thomas Alexander

212 bronze badges

1 Comment

Dan Hanly Over a year ago

the accepted answer said that over 2 months ago. I backticked the table name and it worked. Thanks for the effort, but your a little late for this one

Drewdin · Accepted Answer · 2011-01-21 14:27:58Z

0

Looks like your missing the Link Identifier?

string mysql_real_escape_string ( string $unescaped_string [, resource $link_identifier ] )

answered Jan 21, 2011 at 14:27

Drewdin

1,7625 gold badges23 silver badges35 bronze badges

2 Comments

Viper_Sb Over a year ago

You do know that the link identifier is optional right? "If link_identifier isn't defined, the last MySQL connection is used."

Drewdin Over a year ago

I thought it was required, next time ill just post comments so i dont lose any points!

Collectives™ on Stack Overflow

mysql_real_escape_string not working

4 Answers 4

1 Comment

2 Comments

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

2 Comments

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related